Periodic recertification of users ensures that only authorized individuals retain access to cloud services and helps identify and revoke access for users who no longer require it. This is a critical control for maintaining security and compliance in a cloud environment.
* Classifying Cloud Services (Option A): This is foundational but does not verify ongoing user access.
* Centrally Managing Users (Option B): While useful for consistency, it does not assess whether access rights are still valid.
* Ensuring Cloud Process Resilience (Option C): This focuses on operational continuity rather than access control.
Periodic recertification aligns with governance practices to ensure access rights remain appropriate over time.
Reference: ISACA CISA Review Manual, Job Practice Area 4: Protection of Information Assets.

The most important issue for an IS auditor to consider with regard to Voice-over IP (VoIP) communications is the homogeneity of the network, because it affects the quality, security, and reliability of the VoIP service. A homogeneous network is one that uses a single protocol or standard for VoIP communication, such as Session Initiation Protocol (SIP) or H.32312. A homogeneous network can reduce the complexity, latency, and interoperability issues that may arise from using different or incompatible protocols or devices for VoIP communication12. Continuity of service, identity management, and nonrepudiation are also important issues for VoIP communications, but not as important as the homogeneity of the network. References: 1: CISA Review Manual (Digital Version), Chapter 4, Section 4.4.3 2: CISA Online Review Course, Module 4, Lesson 4